How a tool behaves, which tells the MCP server how to expose it: readonly tools
only read data, mutating tools change it, and destructive tools ask for
confirmation before running.
Signature
type McpToolBehavior = 'readonly' | 'mutating' | 'destructive'